openssh unix dev - Apr 2015 - OpenSSH 6.6.x sends invalid SSH_MSG_USERAUTH_INFO_REQUEST

Darren Tucker <dtucker at zip.com.au> writes:
>That's a vendor-modified version of OpenSSH.  Assuming it corresponds to
>what's in FreeBSD head, there's about a thousand lines of changes. 
Ugh.
>Can you reproduce the problem with an unmodified version from openssh.com?
>Failing that, can you get the server-side debug output from a failing
>connection (ie /path/to/sshd -ddd)?
I've cc'd this to the person who reported it in case he can shed more
light on
the specifics, in the meantime here's the level 3 debug output that he
provided me with (this was previously posted to a public mailing list so I'm
assuming it's not sensitive):

debug2: load_server_config: filename /etc/ssh/sshd_config
debug2: load_server_config: done config len = 188
debug2: parse_server_config: config /etc/ssh/sshd_config len 188
debug3: /etc/ssh/sshd_config:129 setting Subsystem sftp /usr/libexec/sftp-server
debug1: HPN Buffer Size: 65536
debug1: sshd version OpenSSH_6.6.1p1_hpn13v11 FreeBSD-20140420, OpenSSL
1.0.1j-freebsd 15 Oct 2014
debug3: Incorrect RSA1 identifier
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_rsa_key" as a RSA1 public
key
debug1: private host key: #0 type 1 RSA
debug3: Incorrect RSA1 identifier
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type DSA
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_dsa_key" as a RSA1 public
key
debug1: private host key: #1 type 2 DSA
debug3: Incorrect RSA1 identifier
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type ECDSA
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_ecdsa_key" as a RSA1 public
key
debug1: private host key: #2 type 3 ECDSA
debug3: Incorrect RSA1 identifier
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_ed25519_key" as a RSA1
public key
debug1: private host key: #3 type 4 ED25519
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-Dddd'
debug1: rexec_argv[2]='-p'
debug1: rexec_argv[3]='1887'
debug2: fd 3 setting O_NONBLOCK
debug3: ssh_sock_set_v6only: set socket 3 IPV6_V6ONLY
debug1: Bind to port 1887 on ::.
debug1: Server TCP RWIN socket size: 65536
debug1: HPN Buffer Size: 65536
Server listening on :: port 1887.
debug2: fd 4 setting O_NONBLOCK
debug1: Bind to port 1887 on 0.0.0.0.
debug1: Server TCP RWIN socket size: 65536
debug1: HPN Buffer Size: 65536
Server listening on 0.0.0.0 port 1887.
debug1: fd 5 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug3: send_rexec_state: entering fd = 8 config len 188
debug3: ssh_msg_send: type 0
debug3: send_rexec_state: done
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
debug1: res_init()
Connection from ::1 port 50860 on ::1 port 1887
debug1: HPN Disabled: 0, HPN Buffer Size: 65536
debug1: Client protocol version 2.0; client software version cryptlib
debug1: no match: cryptlib
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1_hpn13v11 FreeBSD-20140420
debug2: fd 3 setting O_NONBLOCK
debug3: ssh_sandbox_init: preparing capsicum sandbox
debug2: Network child is on pid 43805
debug3: preauth child monitor started
debug3: privsep user:group 22:22 [preauth]
debug1: permanently_set_uid: 22/22 [preauth]
debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
[preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug2: kex_parse_kexinit: curve25519-sha256 at
libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
[preauth]
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
[preauth]
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm at
openssh.com,aes256-gcm at openssh.com,chacha20-poly1305 at
openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc
at lysator.liu.se
[preauth]
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm at
openssh.com,aes256-gcm at openssh.com,chacha20-poly1305 at
openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc
at lysator.liu.se
[preauth]
debug2: kex_parse_kexinit: hmac-md5-etm at openssh.com,hmac-sha1-etm at
openssh.com,umac-64-etm at openssh.com,umac-128-etm at
openssh.com,hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at
openssh.com,hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at
openssh.com,hmac-md5-96-etm at openssh.com,hmac-md5,hmac-sha1,umac-64 at
openssh.com,umac-128 at
openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160 at
openssh.com,hmac-sha1-96,hmac-md5-96
[preauth]
debug2: kex_parse_kexinit: hmac-md5-etm at openssh.com,hmac-sha1-etm at
openssh.com,umac-64-etm at openssh.com,umac-128-etm at
openssh.com,hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at
openssh.com,hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at
openssh.com,hmac-md5-96-etm at openssh.com,hmac-md5,hmac-sha1,umac-64 at
openssh.com,umac-128 at
openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160 at
openssh.com,hmac-sha1-96,hmac-md5-96
[preauth]
debug2: kex_parse_kexinit: none,zlib at openssh.com [preauth]
debug2: kex_parse_kexinit: none,zlib at openssh.com [preauth]
debug2: kex_parse_kexinit:  [preauth]
debug2: kex_parse_kexinit:  [preauth]
debug2: kex_parse_kexinit: first_kex_follows 0  [preauth]
debug2: kex_parse_kexinit: reserved 0  [preauth]
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256 [preauth]
debug2: kex_parse_kexinit: ssh-rsa [preauth]
debug2: kex_parse_kexinit: 3des-cbc [preauth]
debug2: kex_parse_kexinit: 3des-cbc [preauth]
debug2: kex_parse_kexinit: hmac-sha2-256 [preauth]
debug2: kex_parse_kexinit: hmac-sha2-256 [preauth]
debug2: kex_parse_kexinit: none [preauth]
debug2: kex_parse_kexinit: none [preauth]
debug2: kex_parse_kexinit:  [preauth]
debug2: kex_parse_kexinit:  [preauth]
debug2: kex_parse_kexinit: first_kex_follows 0  [preauth]
debug2: kex_parse_kexinit: reserved 0  [preauth]
debug2: mac_setup: setup hmac-sha2-256 [preauth]
debug1: kex: client->server 3des-cbc hmac-sha2-256 none [preauth]
debug2: mac_setup: setup hmac-sha2-256 [preauth]
debug1: kex: server->client 3des-cbc hmac-sha2-256 none [preauth]
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received [preauth]
debug3: mm_request_send entering: type 0 [preauth]
debug3: mm_choose_dh: waiting for MONITOR_ANS_MODULI [preauth]
debug3: mm_request_receive_expect entering: type 1 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 0
debug3: mm_answer_moduli: got parameters: 1024 1024 8192
debug3: mm_request_send entering: type 1
debug2: monitor_read: 0 used once, disabling now
debug3: mm_choose_dh: remaining 0 [preauth]
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent [preauth]
debug2: bits set: 532/1024 [preauth]
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT [preauth]
debug2: bits set: 507/1024 [preauth]
debug3: mm_key_sign entering [preauth]
debug3: mm_request_send entering: type 6 [preauth]
debug3: mm_key_sign: waiting for MONITOR_ANS_SIGN [preauth]
debug3: mm_request_receive_expect entering: type 7 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 6
debug3: mm_answer_sign
debug3: mm_answer_sign: signature 0x8040858c0(271)
debug3: mm_request_send entering: type 7
debug2: monitor_read: 6 used once, disabling now
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent [preauth]
debug2: kex_derive_keys [preauth]
debug2: set_newkeys: mode 1 [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug2: set_newkeys: mode 0 [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: KEX done [preauth]
debug3: Trying to reverse map address ::1. [preauth]
debug1: userauth-request for user admin service ssh-connection method
password [preauth]
debug1: attempt 0 failures 0 [preauth]
debug3: mm_getpwnamallow entering [preauth]
debug3: mm_request_send entering: type 8 [preauth]
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
debug3: mm_request_receive_expect entering: type 9 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 8
debug3: mm_answer_pwnamallow
debug3: Trying to reverse map address ::1.
debug2: parse_server_config: config reprocess config len 188
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 9
debug2: monitor_read: 8 used once, disabling now
debug2: input_userauth_request: setting up authctxt for admin [preauth]
debug3: mm_start_pam entering [preauth]
debug3: mm_request_send entering: type 100 [preauth]
debug3: mm_inform_authserv entering [preauth]
debug3: mm_request_send entering: type 4 [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 100
debug1: PAM: initializing for "admin"
debug1: PAM: setting PAM_RHOST to "localhost"
debug2: monitor_read: 100 used once, disabling now
debug2: Unrecognized authentication method name: password [preauth]
debug3: userauth_finish: failure partial=0 next
methods="publickey,keyboard-interactive" [preauth]
debug1: userauth-request for user admin service ssh-connection method
keyboard-interactive [preauth]
debug1: attempt 1 failures 1 [preauth]
debug2: input_userauth_request: try method keyboard-interactive [preauth]
debug1: keyboard-interactive devs  [preauth]
debug1: auth2_challenge: user=admin devs= [preauth]
debug1: kbdint_alloc: devices 'pam' [preauth]
debug2: auth2_challenge_start: devices pam [preauth]
debug2: kbdint_next_device: devices <empty> [preauth]
debug1: auth2_challenge_start: trying authentication method 'pam'
[preauth]
debug3: mm_sshpam_init_ctx [preauth]
debug3: mm_request_send entering: type 104 [preauth]
debug3: mm_sshpam_init_ctx: waiting for MONITOR_ANS_PAM_INIT_CTX [preauth]
debug3: mm_request_receive_expect entering: type 105 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 4
debug3: mm_answer_authserv: service=ssh-connection, styledebug2: monitor_read: 4
used once, disabling now
debug3: mm_request_receive entering
debug3: monitor_read: checking request 104
debug3: mm_answer_pam_init_ctx
debug3: PAM: sshpam_init_ctx entering
debug3: mm_request_send entering: type 105
debug3: mm_sshpam_query [preauth]
debug3: mm_request_send entering: type 106 [preauth]
debug3: mm_sshpam_query: waiting for MONITOR_ANS_PAM_QUERY [preauth]
debug3: mm_request_receive_expect entering: type 107 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 106
debug3: mm_answer_pam_query
debug3: PAM: sshpam_query entering
debug3: ssh_msg_recv entering
debug3: PAM: sshpam_thread_conv entering, 1 messages
debug3: ssh_msg_send: type 1
debug3: ssh_msg_recv entering
debug3: mm_request_send entering: type 107
debug3: mm_sshpam_query: pam_query returned 0 [preauth]
Postponed keyboard-interactive for admin from ::1 port 50860 ssh2 [preauth]
debug3: mm_sshpam_respond [preauth]
debug3: mm_request_send entering: type 108 [preauth]
debug3: mm_sshpam_respond: waiting for MONITOR_ANS_PAM_RESPOND [preauth]
debug3: mm_request_receive_expect entering: type 109 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 108
debug3: mm_answer_pam_respond
debug2: PAM: sshpam_respond entering, 1 responses
debug3: ssh_msg_send: type 6
debug3: mm_request_send entering: type 109
debug3: mm_sshpam_respond: pam_respond returned 1 [preauth]
debug3: mm_sshpam_query [preauth]
debug3: mm_request_send entering: type 106 [preauth]
debug3: mm_sshpam_query: waiting for MONITOR_ANS_PAM_QUERY [preauth]
debug3: mm_request_receive_expect entering: type 107 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 106
debug3: mm_answer_pam_query
debug3: PAM: sshpam_query entering
debug3: ssh_msg_recv entering
debug1: do_pam_account: called
debug3: PAM: do_pam_account pam_acct_mgmt = 0 (success)
debug3: ssh_msg_send: type 0
debug3: PAM: import_environments entering
debug3: sshpam_password_change_required 0
debug3: PAM: num env strings 0
debug1: PAM: num PAM env strings 0
debug3: mm_request_send entering: type 107
debug3: mm_sshpam_query: pam_query returned 0 [preauth]
Postponed keyboard-interactive/pam for admin from ::1 port 50860 ssh2
[preauth]
Received disconnect from ::1: 10:  [preauth]
debug1: do_cleanup [preauth]
debug3: PAM: sshpam_thread_cleanup entering [preauth]
debug1: monitor_read_log: child log fd closed
debug3: mm_request_receive entering
debug1: do_cleanup
debug1: PAM: cleanup
debug3: PAM: sshpam_thread_cleanup entering
debug1: Killing privsep child 43805

Peter.

Peter Gutmann wrote:
> Darren Tucker <dtucker at zip.com.au> writes:
>
>> That's a vendor-modified version of OpenSSH.  Assuming it
corresponds to
>> what's in FreeBSD head, there's about a thousand lines of
changes.
> Ugh.
>
>> Can you reproduce the problem with an unmodified version from
openssh.com?
>> Failing that, can you get the server-side debug output from a failing
>> connection (ie /path/to/sshd -ddd)?
> I've cc'd this to the person who reported it in case he can shed
more light on
> the specifics, in the meantime here's the level 3 debug output that he
> provided me with (this was previously posted to a public mailing list so
I'm
> assuming it's not sensitive):
The problem was originally reported via IRC against "a couple different
Linux distros", and I found I could reproduce with my FreeBSD 11 box so
I added a local patch to work around it, sent it to the reporter who
confirmed that it solved his issue.  I can try to find out the specific
distros, though I suspect they have vendor patches as well.

His system also had all the CBC ciphers disabled by default, including
the mandatory 3des-cbc and recommended aes128-cbc, so I suspect a
reaction to some padding oracle attack (I don't really keep up) was
involved on his systems.  It seems that Cryptlib only does CBC, so I had
to walk him through re-enabling those.

Hi Stephen.

I accidentally dropped you off the thread by replying to an earlier post.

The TL;DR is that I think OpenSSH's behaviour is RFC-compliant although not
optimal.

You can read the rest of the thread here:
http://lists.mindrot.org/pipermail/openssh-unix-dev/2015-April/033789.html

On Tue, Apr 7, 2015 at 3:47 PM, Stephen Hurd <shurd at sasktel.net>
wrote:
>
> The problem was originally reported via IRC against "a couple
different
> Linux distros", and I found I could reproduce with my FreeBSD 11 box
so
> I added a local patch to work around it, sent it to the reporter who
> confirmed that it solved his issue.  I can try to find out the specific
> distros, though I suspect they have vendor patches as well.
>
I suspect the behaviour will be present in any system with UsePAM=yes
and KbdInteractiveAuthentication=yes (or
ChallengeResponseAuthentication=yes, from which
KbdInteractiveAuthentication gets its default value).

I also suspect you can work around it by
setting KbdInteractiveAuthentication=no and PasswordAuthentication=yes,
assuming your PAM modules are simple enough that this works.

> His system also had all the CBC ciphers disabled by default, including
> the mandatory 3des-cbc and recommended aes128-cbc, so I suspect a
> reaction to some padding oracle attack (I don't really keep up) was
> involved on his systems.  It seems that Cryptlib only does CBC, so I had
> to walk him through re-enabling those.

FWIW I don't think the ciphers have any impact on this behaviour.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.